Types of lookalike domain

  • Typosquats: misspellings such as exmaple.com.
  • Combosquats: the real brand plus a word, such as example-secure.com or examplepayroll.co.uk.
  • Homoglyphs: characters from other scripts that look identical, for example a Cyrillic letter in place of a Latin one. These are registered as internationalised domain names.
  • Top-level domain swaps: example.net or example.co instead of the real domain.
  • Subdomain tricks: example.com.login-check.net, where the real brand appears at the start but the registered domain belongs to someone else.

Why lookalike domains work

People skim links and sender addresses, especially on mobile screens. A convincing domain combined with a copied login page or an urgent invoice request is often enough. Lookalike domains are also used for business email compromise, where attackers reply in an existing email thread from a near-identical domain to redirect a payment.

How to respond to a lookalike domain

  1. Check whether it has live web content or mail (MX) records, which indicate active use.
  2. Block it in email and web filters.
  3. Warn staff and, if customers are targeted, warn customers.
  4. Collect evidence and request a takedown from the registrar and host.

How DarkInvader helps

DarkInvader finds lookalike domains through DNS and Brand Monitoring, gathers evidence such as screenshots, hosting details and DNS records, and runs the takedown process with registrars and hosting providers through Website Takedowns.

Explore Website Takedowns

Frequently asked questions

What is a homoglyph domain?

A domain that uses characters from another alphabet that look the same as Latin letters, for example a Cyrillic a in place of a Latin a. To a reader the domain looks genuine, but it is a different registration.

Can I stop people registering lookalike domains?

Not entirely. You can register the most likely variations yourself, but there are too many possibilities to cover them all, so monitoring and fast takedown are the main defences.

How long does a lookalike domain takedown take?

It varies by registrar, host and evidence quality. Clear evidence of phishing or impersonation usually speeds things up, and many providers act within days.

Related terms and reading

Sources